INSECURE FUTURES — As the clock struck 5 on Friday, Microsoft slipped in a bombshell blog post disclosing that the elite Russian hackers behind SolarWinds accessed the emails of “a very small percentage” of its top brass. The hackers’ list of victims included cybersecurity and legal staff in an apparent bid to figure out what the tech giant knew about them. Microsoft wants you to think it was a sophisticated digital counter-intelligence coup. But that ignores an uncomfortable reality for a multinational company with a $20 billion cybersecurity business: it appears to have failed Cybersecurity 101. “I love how they wordsmithed it into a warning about how sophisticated these attackers are and the dangerous new world we find ourselves in. When in reality it appears to have been a massive failure of security best practice,” said Marc Rogers, the chief technology officer at nbhd.ai. — The methods: Microsoft said the hackers used a password spray attack to “compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts.” That caught a lot of eyes in the security community for two reasons: first, non-production tenants — generally set up for software testing and troubleshooting — aren’t supposed to be hooked up to “production” — that is, live services. Second, Microsoft seems not only to have forgotten about this legacy (you know, “old”) account, but protected it with weak authentication. “You would think that the executive leadership of Microsoft and their cybersecurity team would be running in a more secure environment,” said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. “So seemingly the largest enterprise in the world doesn't know how to implement multi-factor authentication.” — The purveyors of chaos: Microsoft’s team pointed the finger at Midnight Blizzard, a cyber gang linked to the Russian Foreign Intelligence Service also behind the 2020 SolarWinds supply chain hack. Russia’s SVR is responsible for diplomatic and political intel abroad, a signal that the hack against Microsoft meant that it wanted to prepare and understand everything Microsoft knew about it. — Teflon don: The global company used by governments, businesses and think tanks has had a spell of security issues over the last few months, including Chinese-based hackers gaining email access to high ranking government officials, including Commerce Secretary Gina Raimondo, and State Department communications over the summer. The July hack triggered a slew of Washington actions, including a letter from Sen. Ron Wyden (D-Ore.) to agency heads urging an investigation into Microsoft’s practices. The Cyber Safety Review Board is currently in the midst of an investigation over those hacks. — A few caveats: Microsoft deserves some credit for announcing the hack (though it might’ve had to, due to those new SEC regulations). In the post, it also committed to immediately apply “current security standards” to its own legacy systems and internal business processes — even at the cost of some disruption. — But let’s be real: We’re not exactly buying Microsoft's argument that the major takeaway is what the hackers did, as opposed to what the security giant didn’t do. The firm recently pledged to up its security game as part of a glitzy new initiative called “Secure our Future.” Let’s hope it doesn’t look like this.
| 
Comments
Post a Comment